CVE-2025-34502
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem and gain persistent code execution on reboot. This weakness allows long-term firmware tampering that survives power cycles. The vendor indicates that more recent firmware updates strengthen update-chain integrity and disable physical update ports to mitigate related attack avenues.
Risk Assessment
An attacker with physical access can permanently modify firmware, potentially leading to full device compromise and loss of control.
Recommendation
Update Deck Mate 2 firmware to the latest version and restrict physical access to the device.
Other vulnerabilities in Deck Mate 2
See all- CVE-2025-34503High
Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots.
- CVE-2025-34500High
Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. An attacker with access to the update interface (typically via the USB update port) can craft or modify firmware packages to execute arbitrary code as root, persistently compromising the device's integrity and deck randomization process.
Original NVD description (English source)
Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem and gain persistent code execution on reboot. This weakness allows long-term firmware tampering that survives power cycles. The vendor indicates that more recent firmware updates strengthen update-chain integrity and disable physical update ports to mitigate related attack avenues.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS